The vulnerability is a CSRF flaw in the yonisink Custom Post Type Images WordPress plugin that allows an attacker to inject arbitrary code into the site. Because the plugin accepts form data without validating a CSRF token, a forged request can execute custom code that the attacker supplies, potentially giving them control over the site's files and functionality.

The issue affects all WordPress installations that use yonisink Custom Post Type Images plugin version 0.5 or earlier. Any site hosting this plugin before the vulnerability is fixed is at risk.

This flaw has a CVSS score of 9.6, indicating a high severity level. The EPSS score is less than 1%, suggesting a low current exploitation probability, and it is not listed in the CISA KEV catalog. Based on the description, it is inferred that the likely attack vector is a forged HTTP request that a victim can trigger by visiting a malicious link or loading a page containing malicious code. The lack of CSRF protection allows attackers to submit code that the site will execute, potentially compromising site integrity and confidentiality.